<?php
session_start();

if (isset($_SESSION["loggedin"]) && $_SESSION["loggedin"] === true) {
    header("location: ../form.php");
    exit;
}

require_once '../includes/db_hosoffice.php';

if ($_SERVER["REQUEST_METHOD"] == "POST") {

    $user = trim($_POST['username'] ?? '');
    $pass = trim($_POST['password'] ?? '');

    if (empty($user) || empty($pass)) {
        $_SESSION['login_error'] = "กรุณากรอก Username และ Password";
        header("location: ../index.php");
        exit;
    }

    $pass_md5 = MD5($pass);

    $sql = "SELECT a.HR_CID, a.HR_PASSWORD, a.HR_STATUS_ID, e.HR_PREFIX_NAME, a.HR_FNAME, a.HR_LNAME,
                   p.HR_POSITION_NAME, d.HR_DEPARTMENT_SUB_SUB_NAME
            FROM hr_person a  
            LEFT OUTER JOIN hr_prefix e ON a.HR_PREFIX_ID=e.HR_PREFIX_ID 
            LEFT OUTER JOIN hr_position p ON a.HR_POSITION_ID=p.HR_POSITION_ID
            LEFT OUTER JOIN hr_department_sub_sub d ON a.HR_DEPARTMENT_SUB_SUB_ID=d.HR_DEPARTMENT_SUB_SUB_ID
            WHERE a.HR_USERNAME = :user LIMIT 1";

    try {
        $stmt = $pdo_hos->prepare($sql);
        $stmt->execute(['user' => $user]);
        $row = $stmt->fetch(PDO::FETCH_ASSOC);

        if (!$row) {
            $_SESSION['login_error'] = "ไม่พบบัญชีผู้ใช้นี้";
            header("location: ../index.php");
            exit;
        }

        if (strtolower($row['HR_PASSWORD']) !== strtolower($pass_md5)) {
            $_SESSION['login_error'] = "รหัสผ่านไม่ถูกต้อง";
            header("location: ../index.php");
            exit;
        }

        if ($row['HR_STATUS_ID'] !== '01') {
            $_SESSION['login_error'] = "บัญชีผู้ใช้นี้ถูกปิดการใช้งานไปแล้ว";
            header("location: ../index.php");
            exit;
        }

        unset($_SESSION['login_error']);

        $_SESSION['loggedin'] = true;
        $_SESSION['fullname'] = $row['HR_PREFIX_NAME'] . $row['HR_FNAME'] . " " . $row['HR_LNAME'];
        $_SESSION['cid'] = $row['HR_CID'];
        $_SESSION['position'] = $row['HR_POSITION_NAME'] ?? '';
        $_SESSION['department'] = $row['HR_DEPARTMENT_SUB_SUB_NAME'] ?? '';
        
        // Include db_assessment.php to get $super_admins
        require_once '../includes/db_assessment.php';
        $_SESSION['is_admin'] = in_array($row['HR_CID'], $super_admins);
        
        // Admin check (optional, if you want admins to go to summary.php instead of form.php)
        // For now, redirect everyone to the form. 
        header("location: ../form.php");
        exit;
    } catch (PDOException $e) {
        $_SESSION['login_error'] = "เกิดข้อผิดพลาดของระบบฐานข้อมูล";
        // log error securely $e->getMessage()
        header("location: ../index.php");
        exit;
    }
} else {
    header("location: ../index.php");
    exit;
}